fix(release): preserve annotated tag refs

[codeforester]

Summary

• restore the annotated tag ref after actions/checkout in both release jobs
• fail closed if the checked-out tag is not an annotated tag
• keep provenance and final asset checks bound to the exact tag target

Validation

• git diff --check
• bats tests/release_test.bats
• release workflow YAML parsed successfully
• reproduced v0.2.0 failure was the checkout ref being rewritten as a lightweight tag; the remote tag itself remains annotated and immutable